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United States District Court 
District of Columbia 

AFFIDAVIT OF SPECIAL AGENT MATTHEW MAHONEY IN SUPPORT OF 
APPLICATION FOR SEARCH WARRANT 

Your affiant, IVIattliew K. IVIalioney, being duly sworn, hereby depose and state as follows: 



A. Introduction and Agent Background 

1 . I make this affidavit in support of an application for a search warrant for a certain 
account controlled by the free web-based electronic mail service provider known as MSN 
Hotmail headquartered at 1 065 La Avenida, Mountain View, California 94043. The account 
to be searched is NADIAGASTELUM@H0TMAIL.COM which is further described in the 
following paragraphs and in Attachment A. As set forth herein, there is probable cause to 
believe that on the computer systems of MSN Hotmail, there exists evidence, fruits, and 
instrumentalities of violations of Title 21 United States Code, Section 952 (Importation of a 
controlled substance). Section 959(a) (Manufacture or distribution for purpose of unlawful 
importation). Section 963 (Attempt and Conspiracy) and Title 46 United States Code 
Appendix, Section 1903 (Distribution and possession with intent to distribute on board 
vessels). 

2. I am a Special Agent of the Drug Enforcement Administration (DEA) assigned to 
the Bilateral Case Group, Special Operations Division. As such, I am an "investigative or 
law enforcement officer" of the United States within the meaning of Title 1 8, United States 
Code, Section 251 0(7), that is, an officer of the United States who is empowered by law to 
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conduct investigations of and to make arrests for offenses enumerated in Title 18, United 
States Code, Section 2516(1). 

3. I have been employed as a Special Agent with the DBA for approximately nine (9) 
years, during which time I have specialized in investigations involving narcotics trafficking. I 
received sixteen (16) weeks of training at the DBA Academy at Quantico, Virginia, and 
have received extensive training pertaining to narcotic investigations and the investigation 
of various crimes which arise from drug trafficking activities. 

4. I have been personally involved in investigations concerning the possession, 
manufacture, distribution, and importation of controlled substances, as well as methods 
used to finance drug transactions. 

5. I have participated in and conducted investigations of violations of various State 
and Federal criminal laws, including unlawful possession with intent to distribute controlled 
substances, distribution of controlled substances, use of a communication facility to commit 
narcotic offenses, importation of controlled substances, conspiracy to import, possess and 
distribute controlled substances, and money laundering, all in violation of Title 21 and Title 
18, United States Code. These investigations resulted in arrests of individuals who have 
imported, smuggled, received and distributed controlled substances, including cocaine, 
marijuana, heroin, methamphetamine and MDMA, and the arrest of individuals who have 
laundered proceeds emanating from those illegal activities. Also, these investigations 
resulted in seizures of illegal drugs and proceeds of the distribution of those illegal drugs. 

6. I have also conducted investigations concerning the identification of co- 
conspirators through the use of telephone records and bills, financial records, drug ledgers. 
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photographs, and other documents. I have also participated in the debriefings of many of 
those individuals arrested who later cooperated with the Government. 

7. I have directed numerous confidential informants and cooperating witnesses to 
successfully infiltrate various-sized narcotic enterprises via intelligence gathering, 
participation in consensual recordings and monitored purchases of controlled substances. I 
have executed search warrants for controlled substances and I have conducted 
surveillance in connection with numerous narcotic investigations. 

8. I am familiar with the operations of illegal international drug trafficking 
organizations in various parts of the world, including South America and Mexico. 

9. I am familiar with the ways in which narcotic traffickers conduct their business, 
including methods of importing and distributing narcotics, money laundering, the use of 
satellite phones, cellular telephones and the internet to facilitate their illegal acts, and the 
use of numerical codes and code words to conduct drug transactions. My training and 
experience as a Special Agent of the DBA, my conversations with other Special Agents of 
the DBA, foreign law enforcement, state and local investigators familiar with narcotics 
trafficking and money laundering matters, form the basis of the opinions and conclusions 
set forth below, which I drew from the facts set forth herein. 

10. In my training and experience, I have learned that MSN Hotmail is a company 
that provides free web based Internet electronic mail ("e-mail") access to the general 
public, and that stored electronic communications, including opened and unopened e-mail 
for MSN Hotmail subscribers may be located on the computers of MSN Hotmail. Further, I 
am aware that computers located at MSN Hotmail contain information and other stored 



Case 1 :06-mj-001 98-AK Document 1 -2 Filed 05/05/2006 Page 4 of 1 5 

electronic communications belonging to unrelated third parties. Accordingly, this affidavit 
and application for search warrant seeks authorization solely to search the computer 
accounts and/or files by following the procedures described herein and in Attachment A. 

B. Background Regarding Computers, the Internet, and E-mail 

11. The term "computer" as used herein is defined in 18 U.S.C. 1030(e)(1), and 
includes an electronic, magnetic, optical, electrochemical, or other high speed data 
processing device performing logical, arithmetic, or storage functions, and includes any 
data storage facility or communications facility directly related to or operating in conjunction 
with such device. 

12. Based on my training, experience and knowledge, I know the following: 

a. The Internet is a worldwide network of computer systems operated by 
governmental entities, corporations, and universities. In order to access the Internet, and 
individual computer user must subscribe to an access provider, which operates a host 
computer system with direct access to the Internet. The World Wide Web ("www") is a 
functionality of the Internet, which allows users of the Internet to share information; 

b. With a computer connected to the Internet, an individual computer user can 
make electronic contact with millions of computers around the world. This connection can 
be made by any means, including modem, local area network, wireless and numerous 
other methods; and 

c. E-mail is a popular form of transmitting messages and/or files in an 
electronic environment between computer users. When an individual computer user sends 
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e-mail, it is initiated at the user's computer, transmitted to the subscriber's mail server, then 
transmitted to its final destination. A server is a computer that is attached to a dedicated 
network and serves many users. An e-mail server may allow users to post and read 
messages and to communicate via electronic means. 

C. MSN Hotmail 

13. Based on my training and experience, I have learned the following about 
Hotmail : 

a. Hotmail is an e-mail service which is available free of charge to Internet 
users. Subscribers obtain an account by registering on the Internet with MSN 
Hotmail. MSN Hotmail requests subscribers to provide basic information, such as 
name, gender, zip code and other personal/biographical information. However, 
MSN Hotmail does not verify the information provided; 

b. MSN Hotmail maintains electronic records pertaining to the individuals and 
companies for which they maintain subscriber accounts. These records include 
account access information, e-mail transaction information, and account application 
information; 

c. Subscribers to MSN Hotmail may access their accounts on servers 
maintained and/or owned by Hotmail from any computer connected to the Internet 
located anywhere in the world; 

d. Any e-mail that is sent to an MSN Hotmail subscriber is stored in the 
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subscriber's "mailbox" on MSN Hotmail's servers until the subscriber deletes the e- 
mail or the subscriber's mailbox exceeds the storage limits preset by MSN Hotmail. 
If the message is not deleted by the subscriber, the account is below the maximum 
limit, and the subscriber accesses the account periodically, that message can 
remain on MSN Hotmail's servers indefinitely; 

e. When the subscriber sends an e-mail, it is initiated at the user's computer, 
transmitted via the Internet to MSN Hotmail's servers, and then transmitted to its 
end destination. MSN Hotmail users have the option of saving a copy of the e-mail 
sent. Unless the sender of the e-mail specifically deletes the e-mail from the MSN 
Hotmail server, the e-mail can remain on the system indefinitely. The sender can 
delete the stored e-mail message thereby eliminating it from the e-mail box 
maintained at MSN Hotmail, but that message will remain in the recipient's e-mail 
box unless the recipient deletes it as well or unless the recipient's account is subject 
to account size limitations; 

f. A MSN Hotmail subscriber can store files, including e-mails and image files, 
on servers maintained and/or owned by MSN Hotmail; and 

g. E-mails and image files stored on a MSN Hotmail server by a subscriber 
may not necessarily be located in the subscriber's home computer. The subscriber 
may store e-mails and/or other files on the MSN Hotmail server for which there is 
insufficient storage space in the subscriber's computer and/or which he/she does 
not wish to maintain in the computer in his/her residence. A search of the files in the 
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computer in tine subscriber's residence will not necessarily uncover the files that the 
subscriber has stored on the MSN Hotmail server. 

D. Stored Wire and Electronic Communication Access 

14. Title 18, United States Code, Chapter 121, Sections 2701 through 2711, is 
entitled "Stored Wire and Electronic Communications and Transactional Records Access." 

a) Title 18, United States Code, Section 2703(a), provides: 

A governmental entity may require the disclosure by a provider of electronic 
communication service of the contents of a wire or electronic communication, 
that is in electronic storage in an electronic communications system for one 
hundred and eighty days or less, only pursuant to a warrant issued using the 
procedures described in the Federal Rules of Criminal Procedure by a court 
with jurisdiction over the offense under investigation or equivalent State 
warrant. A governmental entity may require the disclosure by a provider of 
electronic communications services of the contents of a wire or electronic 
communication that has been in electronic storage in an electronic 
communications system for more than one hundred and eighty days by the 
means available under subsection (b) of this section. 

b) Title 18, United States Code, Section 2703(b), provides, in part: 

(1 ) A government entity may require a provider of remote computing service 

to disclose the contents of any electronic communication to which this 
paragraph is made applicable by paragraph (2) of this subsection- 
(A) without required notice to the subscriber or customer, if the 
governmental entity obtains a warrant issued using the procedures 
described in the Federal Rules of Criminal Procedure by a court with 
jurisdiction over the offense under investigation. . . 

(2) Paragraph (1 ) is applicable with respect to any electronic communication 

that is held or maintained on that service - 

(A) On behalf of, and received by means of electronic transmission 
from (or created by means of computer processing of communications 
received by means of electronic transmission from), a subscriber or 
customer of such remote computing service; and 
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(B) Solely for the purpose of providing storage or computer processing 
services to such subscriber or customer, if the provider is not 
authorized to access the contents of any such communications for 
purposes of providing any services other than storage or computer 
processing. 



c) The government may also obtain records and other information pertaining to a 
subscriber to or customer of electronic communication service or remote computing service 
by way of a search warrant. 18 U.S.C. 2703(c)(1)(A). No notice to the subscriber or 
customer is required. 18 U.S.C. 2703(c)(3). 

d) Title 18, United States Code, Section 2711, provides, in part: 

As used in this chapter - 

(1) The terms defined in section 2510 of this title have, respectively, the 
definitions given such terms in that section; and 

(2) The term "remote computing service" means the provision to the public of 
computer storage or processing services by means of an electronic 
communications system. 

e) Title 18, United States Code, Section 2510, provides, in part: 

(8) "contents" when used in respect to any wire, oral, or electronic 
communication, includes any information concerning the substance, purport, 
or meaning of that communication... 

(14) "electronic communications system" means any wire, radio, 
electromagnetic, photo optical or photo electronic facilities for the 
transmission of electronic communications, and any computer facilities or 
related electronic equipment for the electronic storage of such 
communications; 

(1 5) "electronic communications service" means any service which provides 
the users thereof the ability to send or receive wire or electronic 
communications;... 

(17) "electronic storage" means - 

(A) any temporary, intermediate storage of a wire or electronic 
communication incidental to the electronic transmission thereof; and 
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(B) any storage of such communication by an electronic 
communication service for purposes of backup protection of such 
communication. 



E. Search Procedure 

1 5. In order to ensure that Agents search only those computer accounts and or files 
described in Attachment A, this affidavit and application for search warrant seeks 
authorization to permit employees of MSN Hotmail to assist agents in the execution of this 
warrant. To further ensure that Agents executing this warrant search only those computer 
accounts and/or files described in Attachment A, the following procedures will be 
implemented: 

a. The search warrant will be presented to MSN Hotmail personnel who will 
be directed to isolate those accounts and files described in Attachment A; 

b. In order to minimize any disruption of computer service to innocent third 
parties, MSN Hotmail employees (with or without law enforcement personnel) 
trained in the operation of computers will create an exact duplicate of the computer 
accounts and files described in Attachment A, including an exact duplicate of all 
information stored in the computer accounts and files described in Attachment A;^ 

c. MSN Hotmail employees will provide the exact duplicate in electronic form 
of the accounts and files described in Attachment A and all information stored in 
those accounts and files to the agent who serves this search warrant; 



^The absence of a law enforcement officer at the time of the actual search 
in the context of computer files located with an Internet Service Provider has 
been deemed constitutional. United States v. Bach , 310 F.3d 1063 (8*^ Cir. 
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d. Law enforcement personnel will thereafter review the information stored in 
the accounts and files received from MSN Hotmail employees and then identify and 
copy the information contained in those accounts and files which are authorized to 
be further copied by this search warrant; and 

e. Law enforcement personnel will then seal the original duplicate of the 
accounts and files received from MSN Hotmail employees and will not further review 
the original duplicate absent an order of the Court. 

F. Basis for Facts Contained in tliis Affidavit 

16. I make this affidavit, in part, based on personal knowledge derived from my 
participation in this investigation and, in part, based upon information from the following 
sources: 

a. Oral and written reports about this investigation and others that I have 
received from United States and Mexican law enforcement officers, including 
Special Agents of the Drug Enforcement Administration (hereafter DEA.) 

b. Debriefings of a Confidential Source (hereafter CS) done by DEA 
agents, as outlined below, which has been reported to me either directly or 
indirectly; 

c. A review of log history and Internet Protocol addresses for e-mail 
accounts; 

2002), cert, denied ^23 S. Ct. 1873 (2003). 
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1 7. Except where otherwise noted, the information set forth in this affidavit has been 
provided to me directly or indirectly by Special Agents of the DEA or other law enforcement 
officers. Unless otherwise noted, wherever in this affidavit I assert that a statement was 
made, the information was provided by another law enforcement officer (who may have had 
either direct or hearsay knowledge of the statement) to whom I have spoken or whose 
report I have read and reviewed. Such statements are among many statements made by 
others and are stated in substance, unless otherwise indicated. 

18. I have not set forth each and every fact learned during the course of this 
investigation. Rather, I have set forth only the facts that I believe are necessary to 
establish probable cause for the issuance of a search and seizure warrant based on the 
instant affidavit. 

G. Probable Cause 

19. Juan Jose ESPARRAGOZA-MORENO is a DEA Consolidated Priority 
Target Organization (CPOT). On April 9, 2003, ESARRAGOZA-MORENO was indicted 
in the U.S. for the following charges: in Count One, with conspiracy to violate Title 21 , 
United States Code (USC), Sections 952(a), 960(a)(1), and 960(b)(1)(G) (importation of 
more than 1000 kilograms of a controlled substance [marijuana] into the United States), 
in violation of Title 21 , USC, Section 963; in Count Two, with conspiracy to violate Title 
21 , USC, Sections 841 (a)(1 ) and 841 (b)(1 )(B)(vii) (possession with intent to distribute 
more than 100 kilograms of a controlled substance [marijuana]), in violation of Title 21 , 
USC, Section 846; and in Count Three, with importation of more than 1000 kilograms of 
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a controlled substance [marijuana], into the United States, in violation of Title 21 , USC, 
Sections 952(a), 960(a)(1) and 960(b)(1)(G). 

20. The DBA has identified 2 daughters of ESPARRAGOZA-MORENO-- NADIA 
ESPARRAGOZA-GASTELUM, who is currently living in Barcelona, Spain and Brenda 
ESPARRAGOZA-GASTELLUM, who is currently living in Mexico City, Mexico. Both are 
believed to be in communication with ESPARRAGOZA-MORENO and other family 
members via the internet email addresses of NADIAGASTELUM@H0TMAIL.COM and 
MORCHITA87@HOTMAIL.COM . 

21 . DEA agents in Mexico City have determined that in 1 999 NADIA 
ESPARRAGOZA-GASTELUM submitted a U.S. workers visa application to the U.S. 
Embassy there. On that application, she listed NADIAGASTELUM@H0TMAIL.COM as 
her e-mail address. In November 2005, the DEA sent MSN Hotmail an administrative 
subpoena concerning the account. In response, MSN Hotmail stated that the account 
was registered to "Nadia Gastelum" in Barcelona Spain and was an active account. 

22. On December 12, 2005, your affiant applied for a search warrant for 
NADIAGASTELUM@H0TMAIL.COM , and Magistrate Judge Facciola issued one (Misc. 
No. 05-655-M-01). 

23. On December 12, 2005, the search warrant was executed, providing a 
snapshot of the account information and e-mails present on the account on that 
particular day. This account and e-mail information was provided to your affiant. There 
were several e-mails were present on the account, and were provided to a translator, as 
they were in Spanish. While no e-mails were present on the account to or from 



Case 1 :06-mj-001 98-AK Document 1 -2 Filed 05/05/2006 Page 1 3 of 1 5 

ESPARRAGOZA-MORENO at that time, tliere were several e-mails to and from an 
account with the address MOROCHITA87@HOTMAIL.COM and were addressed to 
"Brenda." Based on her review of the contents of the e-mail, the translator indicates 
that "Brenda" appears to be a sister. 

24. On May 2, 2006, the DEA issued an administrative subpoena to MSN 
Hotmail for information regarding MOROCHITA87@HOTMAIL.COM . MSN Hotmail 
responded, indicating that the account is registered to "Brenda E.G.," was opened in 
Mexico City, Mexico and is currently active. The DEA office in Mexico City reports that 
ESPARRAGOZA-MORENO has another daughter named BRENDA ESPARRAGOZA- 
GASTELUM. 

25. The DEA office in Madrid, Spain reports that ESPARRAGOZA-MORENO's 
family, including Brenda and Nadia, are currently in vacation in Europe, having traveled 
from Spain to Italy, and then back to Barcelona, where they are currently located. It is 
believed that ESPARRAGOZA-MORENO may travel from Mexico to Spain to visit his 
family in early May 2006. Further, because of his drug trafficking activities, 
ESPARRAGOZA-MORENO is unlikely to share his travel arrangements over the phone, 
which drug traffickers commonly know are monitored by authorities. Therefore, e-mail 
communication, which your affiant knows drug traffickers believe to be a safer way of 
communicating, is the most likely method of communicating with the family and sharing 
his travel plans. Having this travel information will aid in the location and arrest of 
ESPARRAGOZA-MORENO. 
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H. Conclusion 

26. Based upon the information above, your affiant believes that probable cause 
exists that the computer systems owned, maintained, and/or operated by MSN Hotmail 
headquartered at 1605 La Avenida, Mountain View, California 94043, contain evidence, 
fruits, and instrumentalities of violations of Title 21 United States Code, Section 952 
(Importation of a controlled substance). Section 959(a) (Manufacture or distribution for 
purpose of unlawful importation). Section 963 (Attempt and Conspiracy) . By this affidavit 
and application, I request that the Court issue a search warrant directed to MSN Hotmail to 
allow agents to seize e-mail, attachments and other information (described in Attachment 
A, part II) stored on the MSN Hotmail servers for the computer account and files associated 
with NADIAGASTELUM(g)HOTMAIL.COM and to follow the search procedure described in 
Attachment A, part I. 

I. Request for Sealing 

27. Since this investigation is continuing, disclosure of the search warrant, this 
affidavit, and/or this application and the attachments thereto will jeopardize the progress of 
the investigation. Accordingly, I request that the Court issue an order that the search 
warrant, this affidavit in support of application for search warrant, the application for search 
warrant, and the attachment thereto be filed under seal until further order of this Court, and 
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directing IVISN Hotmail not to disclose to the subscriber(s) or any other person the 
existence of the same application, affidavit, search warrant and attachment, until directed to 
do so by the Court.. 



Matthew K. Mahoney 

Special Agent 

Drug Enforcement Administration 



Sworn to and subscribed before me this day of May, 2006. 



Honorable Alan Kay 

District Court Magistrate Judge 



